CVE-2026-54377
MediumCVSS 6.5Summary
The VitaFit cloud API before 2026-10-30 contained an insecure direct object reference vulnerability allowing authenticated attackers to access another user's data by supplying a different user_id or profile_id to endpoints such as GET /front/profile/{profile_id}/report/. Predictable identifier relationships and an account-enumeration weakness enabled mass reading of other accounts' email, profile, body-composition report, and measurement history.
Risk Assessment
Breaches confidentiality of personal and health data of many users, potentially triggering breach-notification obligations and legal liability.
Recommendation
Update the VitaFit API to a version after 2026-10-30 and enforce object-level authorization verifying resource ownership for every profile_id.
Other vulnerabilities in VitaFit cloud API
See all- CVE-2026-54383Medium
VitaFit cloud API before 2026-10-30 contained an excessive data exposure vulnerability allowing any authenticated user to query the GET /front/relation/search/ endpoint and retrieve PII and health-related profile information for user records. Attackers can enumerate the user directory using overlapping alphanumeric search terms to harvest identifiers, emails, birthdays, gender, height, weight goals, phone numbers, and Firebase UIDs.
- CVE-2026-54382High
VitaFit cloud API before 2026-10-30 contained an improper access control vulnerability in its Cognito-issued AWS role that allows authenticated attackers to perform s3:PutObject operations across the entire shared bucket instead of being restricted to their own folder. Attackers can overwrite other users' objects in the shared S3 bucket using credentials obtained via CVE-2026-54378.
- CVE-2026-54381High
VitaFit cloud API before 2026-10-30 contained a misconfigured cloud storage bucket vulnerability that allows unauthenticated attackers to list and download stored files without authentication. Attackers can enumerate the publicly accessible bucket containing 129,947 objects, including 126,881 user-uploaded profile images.
- CVE-2026-54380Medium
The VitaFit cloud API before 2026-10-30 contained a stored cross-site scripting vulnerability allowing authenticated attackers to upload an SVG image with malicious JavaScript to the shared storage bucket. The application failed to restrict scripts or force downloads for image/svg+xml content, so the JavaScript executed when a victim opened the file via direct browser navigation.
- CVE-2026-54384Critical
VitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability that allows remote attackers to obtain a full session for a victim's account by submitting a linked Google or Facebook account identifier to the POST /front/login/sns/ endpoint without providing proof of ownership from the identity provider. Attackers can forge a login using an identifier exposed through account enumeration to read and modify the victim's profile and delete the account's authentication record.
- CVE-2026-54378Critical
VitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that allows any authenticated user to obtain temporary AWS credentials by calling the POST /front/user/s3/token/ endpoint. Attackers can use these improperly scoped credentials to list the shared storage bucket and read or overwrite other users' stored files.
Original NVD description (English source)
VitaFit cloud API before 2026-10-30 contained an insecure direct object reference vulnerability that allows authenticated attackers to access another user's data by supplying a different user_id or profile_id to endpoints such as GET /front/profile/{profile_id}/report/ and GET /front/profile/{profile_id}/body_index_per_day/. Attackers can leverage predictable user_id and profile_id relationships combined with an account-enumeration weakness to read another account's email address, profile, body-composition report, and measurement history at scale.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS